Connecting SailPoint and Microsoft Entra ID

To connect SailPoint with Microsoft Entra ID, perform the following tasks:

Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

To configure a new source:

1. Sign in to SailPoint.
2. Go to Admin > Connections > Sources.
3. Select Create New.
4. Search for the connector by entering the name in the search box, and then select Actions.

5. In the Actions dropdown list, select the setup method:

   • Express Setup - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started.

     Note

     Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to Credential Providers. For more information, contact your SailPoint Customer Service Manager.

   • Standard Setup - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup.

Configuring a Source Using Express Setup

Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data.

1. Review the directions and select Start Express Setup.

2. Review the pre-populated Source Name, Source Owner, and Description. To update, select Edit.

   Note

   The source name must be unique. You can change these settings later in the source configuration.

3. Select Virtual Appliance. A virtual appliance is a Linux-based virtual machine that connects to your sources and apps using SailPoint APIs, connectors, and integrations. For more information about configuring and deploying virtual appliances, refer to SailPoint Virtual Appliances.

4. (Optional) If enabled for your organization, select the Use a Credential Provider checkbox to manage the source's authentication using a credential provider.

   Note

   To add a Credential Provider in SailPoint, go to Admin > Connections > Credential Providers. For more information about credential providers, refer to Credential Providers.

5. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the Connection Settings section.

6. Select Finish.

   After a successful test connection, the system creates your source and prompts you to run an aggregation.

   • If you want to aggregate now, select Aggregate.

     • To see the latest account aggregation history, go to Account Management > Account Aggregation.
     • To see the list of aggregated source accounts, go to Account Management > Accounts.

   • If you want to aggregate later, select Exit. This returns you to the Sources page. Your new source is listed, but contains no accounts or aggregation history yet.

Configuring a Source Using Standard Setup

Use Standard Setup to configure the connector for full feature support.

1. In the Source Name field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
2. In the Description field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
3. In the Source Owner field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to Assigning a Source Owner.

4. Under Connection Type, select Direct Connection or Flat File.

   • Direct Connection - A direct connection fetches data from the Virtual Appliance Cluster you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the Virtual Appliance Reference Guide.
   • Flat File - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.

5. If you selected Direct Connection, in Virtual Appliance Cluster, select the virtual appliance cluster that will be used as the application connector for the source.

6. (Optional) Select a governance group to grant its members source or role sub-admin level oversight of the source and its access. For more information, refer to Creating and Managing Governance Groups.
7. If this source represents a primary system containing your organization's personnel records, select the Authoritative Source checkbox. For more information, refer to Creating Identity Profiles.
8. Select Continue. The source is created, and you are navigated to the Source Setup > Base Configuration page. Continue to configure your connected source there.

Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.

2. In the Source Owner dropdown list, select the identity that owns this source.

   • To find a source owner, begin entering their name.

3. In the Virtual Appliance Cluster dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to SailPoint Virtual Appliances.

4. (Optional) If enabled for your organization, select the Use a Credential Provider checkbox to manage the source's authentication using a credential provider.

   Note

   To add a credential provider, go to Admin > Connections > Credential Providers. For more information about credential providers, refer to Credential Providers.

5. Configure the authentication to allow SailPoint to connect to the source. Refer to Connection Settings for more information.

6. (Optional) In the Governance Group for Source Management dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to Associating Governance Groups with a Source.

7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   • Enable Provisioning - Set the toggle to Enabled to allow the source to create, update, and deactivate accounts in the connected source system.

   • Disable Provisioning - Set the toggle to Disabled to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.

8. Select Save.

Connection Settings

Provide the information required to connect to the Microsoft Entra instance based on the selected Grant Type for OAuth 2.0 authentication:

Client Credentials

1. In the Client ID field, enter the Microsoft Entra ID API Client ID for OAuth2 authentication.

2. In the Client Secret field, enter the Microsoft Entra ID API Client Secret.

3. In the Domain Name field, enter the name of the Microsoft Entra ID domain to be managed. For example, contoso.onmicrosoft.com.

4. (Optional) Select the Manage B2C Tenant checkbox to manage identities in the Azure Active Directory B2C Tenant.

   Note

   Delta Aggregation is not applicable if the Manage B2C Tenant checkbox is selected.

5. (Optional) Select the Use Continuous Access Evaluation checkbox to enable the connector to leverage the Microsoft Entra ID real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).

6. Select Save.

SAML Bearer Assertion

1. In the Client ID field, enter the Microsoft Entra ID API Client ID for OAuth2 authentication.

2. In the Client Secret field, enter the Microsoft Entra ID API Client Secret.

3. Enter the Username for authorization.

4. Enter the Password of the user for authorization.

5. In the Authorization Endpoint field, enter the endpoint URL of authorization server.

6. In the Request Body field, enter the request body for SAML assertion.

   For more information on SAML Request Body, refer to SAML Request Body.

7. In the Domain Name field, enter the name of the Microsoft Entra ID domain to be managed. For example, contoso.onmicrosoft.com.

8. (Optional) Select Manage B2C Tenant checkbox to manage identities in the Azure Active Directory B2C Tenant.

   Note

   Delta Aggregation is not applicable if the Manage B2C Tenant checkbox is selected.

9. (Optional) Select the Use Continuous Access Evaluation checkbox to enable the connector to leverage the Microsoft Entra ID real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).

10. Select Save.

Refresh Token

1. In the Client ID field, enter the Microsoft Entra ID API Client ID for OAuth2 authentication.

2. In the Client Secret field, enter the Microsoft Entra ID API Client Secret.

3. Enter the valid Refresh Token.

4. In the Domain Name field, enter the name of the Microsoft Entra ID domain to be managed. For example, contoso.onmicrosoft.com.

5. (Optional) Select Manage B2C Tenant checkbox to manage identities in the Azure Active Directory B2C Tenant.

   Note

   Delta Aggregation is not applicable if the Manage B2C Tenant checkbox is selected.

6. (Optional) Select the Use Continuous Access Evaluation checkbox to enable the connector to leverage the Microsoft Entra ID real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).

7. Select Save.

JWT Certificate Credentials

To generate the JWT certificate credentials, refer to Creating OAuth 2.0 JWT Certificate Credentials.

1. In the Client ID field, enter the Microsoft Entra ID API Client ID for OAuth2 authentication.

2. In the Certificate field, provide the unique alpha-numeric value of certificate used to sign the JWT assertion.

3. Enter the Private Key text used for encrypting the JWT assertion.

4. Enter the Private Key Password that is used for decrypting the private key.

5. In the Domain Name field, enter the name of the Microsoft Entra ID domain to be managed. For example, contoso.onmicrosoft.com.

6. (Optional) Select Manage B2C Tenant checkbox to manage identities in the Azure Active Directory B2C Tenant.

   Note

   Delta Aggregation is not applicable if the Manage B2C Tenant checkbox is selected.

7. (Optional) Select the Use Continuous Access Evaluation checkbox to enable the connector to leverage the Microsoft Entra ID real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).

8. Select Save.

Aggregation, Filter, and Partitioning Settings

This section contains the configuration parameters for aggregation, filter, and partitioning settings.

For more information about aggregation, refer to Loading Account Data.

For more information on the key factors to consider when choosing between Full Aggregation and Delta Aggregation, refer to FAQs.

Aggregation Settings

1. Select the Aggregate All Groups checkbox to aggregate Security, Microsoft 365, Distribution List, and Mail Enabled Security Groups. If this option is cleared, only Security Groups are aggregated.

2. Select the Delta Aggregation checkbox to aggregate delta changes for accounts and groups.

3. (Applicable for B2C tenant only) Select the Aggregate B2C Membership checkbox to fetch B2C user memberships for all users.

4. Select Exclude Inherited App Role Assignments to exclude inherited appRoleAssignments during account aggregation. Only application roles assigned directly to the account are aggregated. Application roles inherited through group membership are excluded. Group memberships continue to be aggregated.

   By default, both inherited and direct appRoleAssignments are aggregated.

5. Enter the value of Page Size for the number of objects to be fetched in a single page when iterating over large data sets.

Filter Settings

When configuring the filters, consider that the connector prioritizes account filters over group filters during aggregation. For example, the connector aggregates groups, which fall outside of the group filter, if the group is associated with an account included within the account filter.

1. Set the User Filters to define the scope of Accounts applied during account aggregation. For example, to aggregate those Microsoft Entra ID users who are active, use accountEnabled eq true. For more information on filters, refer to the Microsoft documentation.

2. Select Advanced User Filter to include advanced filter queries such as endsWith, NOT, and NE during aggregation processes.

   To use the extension attributes from onPremisesExtensionAttributes e.g. extensionAttribute1 , extensionAttribute4 etc. as user filter, please use the below syntax: onPremisesExtensionAttributes/extensionAttribute1 eq '21'

   User Filters

   Screenshot

   

   Note

   Select the “Advanced User Filter” checkbox as it is advanced query filter.

3. Set the Group Filters to define the scope of Groups applied during group aggregation. Group filters apply during entitlement aggregation. For example, to only aggregate Microsoft Entra ID groups whose display name is starting with letter A, use startswith(displayName,'A'). For more information on filters, refer to the Microsoft documentation.

4. Select Advanced Group Filter to include advanced filter queries such as endsWith, NOT, and NE during group aggregation processes.

5. Select the Group Membership Filters to define the scope of the group memberships included in account aggregation. These filters apply during the account aggregation and are only applicable to memberships belonging to objectType = group. These are only applicable to the Security, Office 365, Mail Enabled Security, and Distributed type of group memberships. For more information on filters, refer to the Microsoft documentation.

   Note

   You can provide filters as mentioned in the examples below, and the connector ensures the formation of an appropriate advanced filter query. This field supports advanced filter queries such as endsWith, NOT, and NE.

   For example,

   • To aggregate only group memberships with group display name starting with 'A', use startswith(displayName,'A').
   • To aggregate only group memberships with groups not belonging to on-premises AD (or to only include cloud group memberships), use onPremisesSyncEnabled ne true.
   • To exclude dynamic group memberships during account aggregation , use NOT groupTypes/any(c:c eq 'DynamicMembership')

   Important

   SailPoint recommends excluding membership information is not a best practice from a governance and security standpoint. You should have full visibility into users and devices, including their groups, assigned permissions, and how these configurations impact access to resources. The group membership filter should be used carefully and only when necessary, ensuring that access is managed and only the right individuals have access to sensitive information or resources.

6. In the Directory Roles Filter field, when the entitlement schema "roles" is present in the source, enter filter statements to ensure that only the specified roles are aggregated during entitlement aggregation. For example, isBuiltIn eq true. For more information on filtering conditions and values, refer to the Microsoft documentation.

7. In the Application Role Filter field, enter any filter statements to apply during entitlement aggregation. An application role is an entitlement object that captures the details related to the AppRoles defined within the scope of enterprise applications. For example:

   • For a filter to match the Enterprise Application default view on the Azure portal use the following:

     tags/Any(x: x eq 'WindowsAzureActiveDirectoryIntegratedApp')

   • For a filter to exclude Microsoft's built-in service principals use the following:

     appOwnerOrganizationId ne f8cdef31-a31e-4b4a-93e4-5f571e91255a&$top=100

8. Select Save.

Partitioning Settings

Partitioning enables your system to process data in parallel across multiple threads and can improve aggregation performance.

1. Select Enable Partitioning if you want to process data in parallel across multiple threads.

2. In the Partitioning Scheme field, enter user filters to define your aggregation partitions. Enter a supported user filter and then press Enter. You can add multiple filters using this method. The filter you define in Partitioning Scheme should evenly distribute all users to be managed across partitions.

   This is a multi-valued attribute. The value consists of different search filters for the attributes that can be filtered (for example, accountEnabled, city, displayName, mail, usageLocation, etc.). The partitioning scheme is a list of user filters where each user filter represents one user partition, and the partitioning scheme defines the scope of accounts applied during account aggregation. For more information, refer to the Microsoft Documentation on using query parameters.

   The following are some example Partitioning Scheme entries based on how you want to configure the partitions:

   • The following examples show you configurations based off of alphabetical inputs:

     • startswith(displayName, 'A')
     • startswith(displayName, 'B')
     • startswith(displayName, 'C')
     • startswith(givenName, 'Smith')

   • You can also define schemes using other attributes:

     • accountEnabled eq true
     • userPrincipalName eq 'Paul@contoso.onmicrosoft.com'

3. Enter the Number of Partitioning Threads the connector should use to concurrently execute your defined partitions. By default, it is set to 2 partitioning threads. If the VA is configured for multiple CPU cores, you can configure a higher number of partition threads to increase the performance.

   Note

   The Number of Partitioning Threads should equal the number of CPU cores on VA*2.

4. Select Save.

Additional Configurations

Additional Settings

This section provides the details about the additional configuration parameters required to customize the connector behavior.

1. Enter the list of errors in Retry Error List which must be retried if occurred during the provisioning operation. Press Enter after each error string to add it to the list.
2. Enter the value for Max Retry Count which indicates the number of times the read operation must be performed on the errors that appear. The default value is 5.
3. If you want to provision a specific role, you can specify this using create policy or Native Rules.
4. Enter the list of errors in Aggregation Retry Error List which must be retried if occurred during aggregation or get operation. Press Enter after each error string to add it to the list.
5. Select Save.

Additional Configuration Parameters

You must add the following attributes in the connector using the SailPoint REST API. Refer to Best Practices: REST API Authentication and REST API - Update Source (Partial).

Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to Review and Test.

2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.

3. Select Test Connection.

SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to Discovered Applications in the SailPoint user interface.

For more information, refer to Application Onboarding in the SailPoint SaaS documentation.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.